New cPanel Flaw Lets a Hosting Account With Mail Privileges Run Code as Root
cPanel patched CVE-2026-67401, an SQL injection in EmailTrack letting an account with mail privileges run code as root on the server.
cPanel released an advisory on September 8 for CVE-2026-67401, an SQL injection in EmailTrack that allows an authenticated account holder with mail-related privileges to create files and execute code as root. All supported cPanel and WHM release lines (11.110, 11.134, 11.136, 11.138 and WP Squared 11.138.1.9) are affected, with fixed builds published for each. No public exploit or exploitation has been reported and the flaw is not yet in CISA's Known Exploited Vulnerabilities catalog. The advisory carries no CVSS score, and the CVE record had not been published as of September 9.
- Authenticated account with mail privileges can write files and run code as root via EmailTrack
- Fixed builds shipped for lines 11.110, 11.134, 11.136, 11.138 and WP Squared 11.138.1.9
- No public exploit or exploitation report; absent from CISA KEV as of September 8
- Third cPanel flaw since July allowing ordinary hosting accounts to reach root
- CVEs
- CVE-2026-67401
- Products
- EmailTrack
- Organizations
- Hadrian
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-67401 | Authenticated SQL Injection in cPanel EmailTrack Leads to Root RCE | 9.9 | <1% | PoC ×5 |
From the original article
3 min read at thehackernews.com
cPanel has patched a flaw that it says lets a single hosting account take control of an entire server. An authenticated account holder with mail-related privileges can create files of their choosing on the server through EmailTrack and, from there, run code as the root user. cPanel published the advisory on September 8 and says every supported version of cPanel and WHM is affected.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.